Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Enterprise Single Sign-On 9.0.2 - One Identity Enterprise Access Management Console Administration Guide

Table of Contents

Preface Overview

Enterprise Access Management Concepts EAM Controllers

EAM Services Domain Controller Selection

A Multi-Domain Architecture Interface general design

Home Window Directory Panel Overview

Authenticating to EAM Console and Managing Protection Modes

Starting/Stopping EAM Console

Starting EAM Console

Starting EAM Console in hardware protection mode Starting EAM Console in software protection mode

Stopping EAM Console

Managing protection modes

Displaying the current protection mode Migrating from software protection mode to hardware protection mode Managing administrators whose administration keys are protected by password

Searching the Directory Tree

Searching for Directory Objects Deleting Search Requests

Managing administrators

Administration Modes - Presentation

The Classic Administration Mode The Advanced Administration Mode Administration Role Inheritance

Delegating Administration Roles Managing Administration Profiles

Creating/Editing an Administration Profile Deleting an Administration Profile

Transferring an Administration Role Deleting an Administration Role Displaying your Administration Role Modifying the Parent Administrator Adding/Removing Primary Administrators

Managing Security Profiles

Managing time slices

Creating/Modifying Time Slices Configuring Time Slices Displaying time slice usage logs Displaying time slice event logs Renaming representative objects Deleting time slices

Managing Password Format Control Policies

Creating/Modifying Password Format Control Policies Configuring Password Format Control Policy Displaying PFCP usage logs Displaying Password Format Control Policy Event Logs Renaming Password Format Control Policies Deleting Password Format Control Policies

Managing User Security Profiles

Creating/Modifying User Security Profiles Configuring User Security Profiles

Authentication Tab Security Tab SSO and Notes Tab Cloud Tab Unlocking Tab (Fast User Switching - FUS) Self Service Password Request Tab Biometrics Tab Session Delegation Tab Audit Tab OTP Tab Mobile Device Tab

Displaying User Security Profile Usage Logs Displaying User Security Profile Event Logs Renaming User Security Profiles Deleting User Security Profiles

Managing Access Point Security Profiles

Creating/Modifying Access Point Security Profiles Configuring Access Point Security Profiles

Security Services Tab Authentication Manager Tab Enterprise SSO Tab Multi-User Desktop Tab Biometrics Tab Self Service Password Request Tab Active RFID Tab Audit Tab Local Administrators Tab

Displaying Access Point Security Profile Usage Logs Displaying Access Point Security Profile Event Logs Renaming Access Point Security Profiles Deleting Access Point Security Profiles

Managing Application Security Profiles

Managing Password Generation Policies

Creating/Modifying Password Generation Policies Configuring the Password Generation Policy Displaying Password Generation Policy Usage Logs Displaying Password Generation Policy Event Logs Renaming Password Generation Policies Deleting Password Generation Policies

Creating/Modifying Application Security Profiles Configuring Application Security Profiles

General Tab Account tab Authentication method Tab Delegation Tab IP Address Constraints Tab

Displaying Application Security Profile Usage Logs Displaying Application Security Profile Event Logs Renaming Application Security Profiles Deleting Application Security Profiles

Defining Security Profiles Default Values Managing User and Access Point Security Profiles Priorities

Managing directory objects

Managing applications

Creating an application

Creating an application without using templates Creating an application using templates

Defining the general properties of an application Creating the account properties for an application

Defining account base parameters Defining account properties

Defining the Single Sign-On properties of an application (SSO) Defining external names Defining the Provisioning Connector Assigning users to an application Sharing the administration of an application Generating/Importing accounts for an application Assigning access points to an application Displaying accounts associated with the application Displaying application event logs Displaying/Modifying application information Renaming applications Deleting applications

Displaying general information about the user Defining user connection parameters

Suspending or limiting temporarily user access Displaying user authentication information and administering roaming sessions Predefining a new user's primary password Managing user Self Service Password Request Defining an audit identifier Creating a welcome message

Assigning a user security profile Declaring a user as administrator Assigning/forbidding access points to a user Managing user accounts Managing the User Self Enrollment

Assigning Administration Rights Configuring the Dedicated Organizational Units Configuring Self Enrollment

Sending SSO account passwords to users Sending primary password expiration notification emails to users Defining additional security parameters for groups of users Managing user smart cards Managing user Mobile Devices Displaying and deleting user biometrics data Assigning applications to a user Displaying delegated sessions Managing user RFID tokens Displaying user event logs Deleting SSO data of disabled user accounts Adding or removing a user from a group

Managing access points

Displaying general information about the access point Defining access point configuration parameters

Assigning an access point security profile Managing EAM controller services Assigning a generic account to an access point

Assigning/forbidding users to an access point Assigning/forbidding applications to an access point Adding or removing an access point from a group Analyzing Errors of a Remote Access Point

Managing the Cache Managing Traces Managing Security Services

Displaying access point event logs Updating manually an access point

Managing representative objects

Managing inbound representative objects

Creating/Modifying an inbound representative object Defining the set of users to represent Assigning a user security profile to the inbound representative object Selecting access points available to the representative

Managing outbound representative objects

Creating/Modifying an outbound representative object Defining the set of access points to represent Selecting applications available to the representative

Displaying representative event logs Renaming representative objects Deleting representative objects

Managing clusters of access points

Creating and configuring a cluster of access points Managing user permissions on clusters

Authorizing users to access the workstations of the cluster Displaying the cluster composed by authorized users

Displaying cluster event logs Renaming clusters Deleting cluster

Selecting a domain controller

Importing/Exporting security profiles and directory objects

Exporting objects from EAM Console Importing objects in EAM Console

Managing smart cards

Configuring smart card parameters of use

Managing smart card configuration profiles

Creating/Modifying configuration profiles Renaming a configuration profile Deleting a configuration profile

Modifying authentication parameters of an assigned smart card Managing batches of smart cards

Creating/modifying a batch of cards Forcing the use of smart cards defined in the batches of cards Displaying information on batches of cards

Managing smart card certificates

Administering smart card certificates

Importing a certification authority Deleting a certification authority

Enabling the automatic renewal of smart card certificates

Assigning smart cards (except loan cards)

Assigning smart cards Assigning a smart card managed by an external CMS Smart card self enrollment Formatting an assigned smart card

Managing loan cards

Assigning a loan card to a user Returning a loan card

Unlocking smart cards

Setting administrator's contact information Unlocking to Forcing PIN Unlocking by secret code Unlocking by SSPR Unlocking by extending the validity duration Formatting a blacklisted card

Managing lost or theft smart cards

Disabling/enabling temporarily smart cards Blacklisting smart cards Assigning a loan card

Formatting smart cards Displaying information

Displaying smart card properties Display the list of supported smart cards

Exporting Generated Reports

Managing SA server devices

Configuring EAM for the management of SA Server devices

Configuring the connection to the SA server Configuring the management of SA Server devices

Managing SA server devices

Assigning an SA server device to a user Formatting an SA Server device Blacklisting an SA Server device Managing the link between the user and the SA Server device

Managing RFID tokens

Assigning an RFID token Locking and unlocking an RFID token

Locking and unlocking an RFID token from the Directory panel Locking and unlocking an RFID token from the RFID panel

Resetting the PIN of an RFID badge Blacklisting and deleting an RFID token

Blacklisting and deleting an RFID token from the Directory panel Blacklisting and deleting an RFID token from the RFID panel

Modifying the detection areas and the grace period Exporting a list of RFID tokens

Managing biometrics

Defining the biometric enrollment policy

Defining the user biometric profile Adjusting the biometric enrollment tool behavior

Defining the workstation biometric parameters Managing the user enrollment Displaying and exporting the biometric enrollment report

Managing Mobile Devices Enabling the public key authentication method

Configuring user and access point security profiles to support the PKA authentication method Activating the PKA authentication method and defining the set of authorized certification authorities

Activating the PKA authentication method Configuring the set of authorized certification authorities

Importing certification authorities from PEM or DER encoded files Importing certification authorities from the Windows system storage Deleting a certification authority

Configuring the automatic update of the revocation information

Importing a CRL point of distribution Importing an OCSP responder Deleting a CRL point of distribution or an OCSP responder

Managing Emergency Accesses

Managing the emergency plan Managing the emergency access

Managing audit events

Displaying audit events Defining an audit population Managing and assigning audit filters

Creating an audit filter Saving an audit filter Loading an audit filter Applying an audit filter

Applying an audit filter to audit records Applying an audit filter to specific objects

Interpreting audit events

The audit main window The "Event details" window Detailed information on the audit administration events

Exporting audit events Archiving audit records Retrieving user identifier from audit identifier Retrieving audit events

Managing reports

Generating PDF reports

Configuring the Reporting Module Managing Report Models Managing Permissions Creating Custom Groups

On-demand Generation Creating a Periodic Generation

Generating On-screen reports

Generating analysis and statistics reports Generating application account reports Generating user account reports Generating administrators report Exporting the generated report

Customizing configuration files

Importing a list of supported authentication tokens Adding user attribute information

Creating scripts

Using the script editor Script commands

CREATE_ROLE CREATE_ACCESS CREATE_ACCOUNT CREATE_COMPUTER_ACCOUNT

Importing script files

Basic syntax of regular expressions Listing audit events and error codes

Listing audit events Listing error codes

Correspondence between profiles and administration rights Report Models and Parameters List

Report List Parameter Description

Custom Group Files Format

Formatting smart cards

Managing smart cards > Formatting smart cards

Formatting smart cards

Subject

Formatting a smart card allows you to reset it in order to use it again. You can format a smart card in the following cases:

To use a card that is already assigned.
When the card is blacklisted.
Upon the return of a loan card.

Procedure

In the Smart Card panel, click the button located in the tool bar.
- The formatting window appears.
Insert the smart card to format in the smart card reader and click Format.
- A confirmation window appears.
Validate information.

Displaying information

Managing smart cards > Displaying information

Displaying information

Task to perform	In classic administration mode, you must have:	In advanced administration mode, you must have:
Displaying smart card properties	"Smart card administrator"	"Token: Modification"
Displaying the list of supported smart cards	"Smart card administrator"	"Token: Modification"

In this section:

Displaying smart card properties

Managing smart cards > Displaying information > Displaying smart card properties

Displaying smart card properties

Subject

The Smart Card panel allows you to identify a smart card and retrieve the following information:

Owner.
Token type (principal or temporary).
Token state.
Token PIN state.
Token class.
Token serial number.
Configuration used to customize the token.
Batch.

Procedure

In the Smart Card panel, click the button located in the tool bar.
- The smart card properties window appears.
If necessary, insert the smart card in the reader, and select the corresponding smart card reader in the list box.
- The properties of the smart card appear, as in the following example:
NOTE: If you have sufficient administration rights, you can click the button to display the Smart Card tab of the corresponding user in the Directory panel.

Display the list of supported smart cards

Managing smart cards > Displaying information > Display the list of supported smart cards

Display the list of supported smart cards

Subject

The different smart card types that can be supported by the solution are defined upon the installation of the EAM Controller. This information is stored in an XML configuration file.

NOTE:

This module is for information only.
You can display the XML configuration file used to extract this information. For more information, see Section Customizing configuration files.

Procedure

In the Smart Card panel, click the Information tab.

The tab appears

Related Documents

© 2020 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy